Hikvision DS-2032-I Console Recovery

alastairstevenson · May 27, 2015

Just out of interest - in case a date check was part of the upgrade validation (though the log does not suggest that), what parts of the date were changed?

dknabe · May 27, 2015

I actually changed the vendor number from 503 to 504. So the date string went from 2015020503xxxxxx to 2015020504xxxxxx.

dknabe · May 27, 2015

I managed to "brick" the camera again. I downloaded the Chinese version of 5.3 from the HIKvsions chinese website and upgraded through the maintenance page.

Here's the console output. There are probably a lot of clues in there on what is going wrong with the upgrade. Notice that it accepts the upgrade file at first, then reboots with
[05-27 09:16:26][pid:841][OTHER][ERROR] checkUserIdValid is ERROR
[05-27 09:16:26][pid:841][SYSLOG][ERROR]Invalid userID 0

It then eventually reboots into the minisystem. The only way to fix this is via TFTP again.

Code:

[05-27 09:15:34][pid:841][PSIA][ERROR]************* PSIA Upgrading BEG **************
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_upglib_init][2179]:HIK CUR iDevType = 0x9805
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_upglib_init][2180]:HIK CUR SoftVers = 0x5020000
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_upglib_init][2181]:HIK CUR SoftDate = 0xe0c01
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_parts_init][1140]:firm upg part[1]: eUpgPrity=0x2,eFirmPart=0x2,eBkupPart=0x1
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_parts_init][1140]:firm upg part[2]: eUpgPrity=0x1,eFirmPart=0x1,eBkupPart=0x2
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_parts_init][1146]:ePartRun=0x1,ePartMain=0x1,ePartBakup=0x2,eUpgRdPart=0x0,iPartsNum=0x2
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_parts_init][1149]:eRetMain=0x0,iVersionFlg=0x10000,iUpgSuccCnt=0x1,iUpgFailCnt=0x0
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_parts_init][1152]:eRetBkup=0x0,iVersionFlg=0x10000,iUpgSuccCnt=0x1,iUpgFailCnt=0x0
UBI device number 2, total 192 LEBs (24772608 bytes, 23.6 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_upglib_proc][2135]:Firm iPackIdx=0 upgrade beg.
[UPG][RT_ERROR][src/sys_firm_upgrade.c][firm_class_get][1448]:szFileName=_cfgUpgSecPls unknown upg drv file!
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_head_check][1275]:devs dev class=0x2,firm dev class=0x2.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_head_check][1281]:devs oem class=0x1,firm oem class=0x1.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_head_check][1299]:szDevsFlg=114005003111111001,szFirmFlg=1140050031111110021.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_head_check][1347]:HIK UPG SoftVers = 0x5030000
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_head_check][1348]:HIK UPG SoftDate = 0x24bf1
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1576]:Firm class check beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1627]:Firm class iClassKey=0x1 iClassLen=0x4 succs.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[0]=0x05.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[1]=0x98.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[2]=0x00.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[3]=0x00.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1627]:Firm class iClassKey=0x2 iClassLen=0x4 succs.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[0]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[1]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[2]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[3]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1627]:Firm class iClassKey=0x3 iClassLen=0x8 succs.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[0]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[1]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[2]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[3]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[4]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[5]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[6]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1631]:Firm class bClassVal[7]=0xff.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_class_check][1638]:Firm class check end.
             total         used         free       shared      buffers
Mem:         95436        66144        29292            0           72
-/+ buffers:              66072        29364
Swap:            0            0            0
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=hImage,iFileLength=0x4d7844,iMapOff=0x4d7844,pSegBuf[0].iov_base=0x41ea7000,iov_len=0x4d7844
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=hroot.img,iFileLength=0x2ea175,iMapOff=0x2ea175,pSegBuf[0].iov_base=0x4237e844,iov_len=0x2ea175
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=initrun.sh,iFileLength=0x1799,iMapOff=0x1799,pSegBuf[0].iov_base=0x426689b9,iov_len=0x1799
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=GBK,iFileLength=0x6f9ec,iMapOff=0x6f9ec,pSegBuf[0].iov_base=0x4266a152,iov_len=0x6f9ec
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=ASC16.bin,iFileLength=0x545,iMapOff=0x545,pSegBuf[0].iov_base=0x426d9b3e,iov_len=0x545
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=IEfile.tar.gz,iFileLength=0x96fba,iMapOff=0x96fba,pSegBuf[0].iov_base=0x426da083,iov_len=0x96fba
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=WebComponents.exe,iFileLength=0x24c958,iMapOff=0x24c958,pSegBuf[0].iov_base=0x4277103d,iov_len=0x24c958
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=execSystemCmd,iFileLength=0x1c00,iMapOff=0x1c00,pSegBuf[0].iov_base=0x429bd995,iov_len=0x1c00
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=da_info,iFileLength=0x7380,iMapOff=0x7380,pSegBuf[0].iov_base=0x429bf595,iov_len=0x7380
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=pppoed,iFileLength=0x4768,iMapOff=0x4768,pSegBuf[0].iov_base=0x429c6915,iov_len=0x4768
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=pppd,iFileLength=0x2dc3c,iMapOff=0x2dc3c,pSegBuf[0].iov_base=0x429cb07d,iov_len=0x2dc3c
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=check_config,iFileLength=0x16bc,iMapOff=0x16bc,pSegBuf[0].iov_base=0x429f8cb9,iov_len=0x16bc
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=alsa-lib.tar.gz,iFileLength=0x3b20,iMapOff=0x3b20,pSegBuf[0].iov_base=0x429fa375,iov_len=0x3b20
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=idsp.tar.gz,iFileLength=0x78d6d,iMapOff=0x78d6d,pSegBuf[0].iov_base=0x429fde95,iov_len=0x78d6d
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=driver.tar.gz,iFileLength=0x151966,iMapOff=0x151966,pSegBuf[0].iov_base=0x42a76c02,iov_len=0x151966
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=cmemk.ko,iFileLength=0x37bd,iMapOff=0x37bd,pSegBuf[0].iov_base=0x42bc8568,iov_len=0x37bd
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=gdmak.ko,iFileLength=0x1734,iMapOff=0x1734,pSegBuf[0].iov_base=0x42bcbd25,iov_len=0x1734
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=recover_mtd,iFileLength=0x37bd,iMapOff=0x37bd,pSegBuf[0].iov_base=0x42bcd459,iov_len=0x37bd
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=ptzCfg.bin,iFileLength=0xbf77,iMapOff=0xbf77,pSegBuf[0].iov_base=0x42bd0c16,iov_len=0xbf77
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=davinci,iFileLength=0x8,iMapOff=0x8,pSegBuf[0].iov_base=0x42bdcb8d,iov_len=0x8
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=davinci.tar.gz,iFileLength=0x40479c,iMapOff=0x40479c,pSegBuf[0].iov_base=0x42bdcb95,iov_len=0x40479c
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=ambarella_eth_debug.ko,iFileLength=0x21f8,iMapOff=0x21f8,pSegBuf[0].iov_base=0x42fe1331,iov_len=0x21f8
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=sound.tar.gz,iFileLength=0x2389a,iMapOff=0x2389a,pSegBuf[0].iov_base=0x42fe3529,iov_len=0x2389a
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=lib_so.tar.gz,iFileLength=0x18b3ee,iMapOff=0x18b3ee,pSegBuf[0].iov_base=0x43006dc3,iov_len=0x18b3ee
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=help.tar.gz,iFileLength=0x39aa5,iMapOff=0x39aa5,pSegBuf[0].iov_base=0x431921b1,iov_len=0x39aa5
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=ss,iFileLength=0x16bc,iMapOff=0x16bc,pSegBuf[0].iov_base=0x431cbc56,iov_len=0x16bc
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1930]:szFileName=t1,iFileLength=0x439b9,iMapOff=0x39cee,pSegBuf[0].iov_base=0x431cd312,iov_len=0x39cee
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_mem_map][1964]:szFileName=t1,iFileLength=0x439b9,iMapOff=0x439b9,pSegBuf[1].iov_base=0x2d270c8,iov_len=0x9ccb
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=_cfgUpgSecPls upgrade read beg.
[UPG][KEY_WARN][src/sys_firm_upgrade.c][firm_file_read][639]:firm upgrade pFileDsc= read skip.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=_cfgUpgSecPls upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=_cfgUpgClass upgrade read beg.
[UPG][KEY_WARN][src/sys_firm_upgrade.c][firm_file_read][639]:firm upgrade pFileDsc= read skip.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=_cfgUpgClass upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=hImage upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=hImage upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=hroot.img upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=hroot.img upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=initrun.sh upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=initrun.sh upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=GBK upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=GBK upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=ASC16.bin upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=ASC16.bin upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=IEfile.tar.gz upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=IEfile.tar.gz upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=WebComponents.exe upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=WebComponents.exe upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=execSystemCmd upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=execSystemCmd upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=da_info upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=da_info upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=pppoed upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=pppoed upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=pppd upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=pppd upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=check_config upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=check_config upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=alsa-lib.tar.gz upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=alsa-lib.tar.gz upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=idsp.tar.gz upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=idsp.tar.gz upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=driver.tar.gz upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=driver.tar.gz upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=cmemk.ko upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=cmemk.ko upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=gdmak.ko upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=gdmak.ko upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=recover_mtd upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=recover_mtd upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=ptzCfg.bin upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=ptzCfg.bin upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=davinci upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=davinci upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=davinci.tar.gz upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=davinci.tar.gz upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=ambarella_eth_debug.ko upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=ambarella_eth_debug.ko upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=sound.tar.gz upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=sound.tar.gz upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=lib_so.tar.gz upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=lib_so.tar.gz upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=help.tar.gz upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=help.tar.gz upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=ss upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=ss upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2012]:Firm file=t1 upgrade read beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_read][2034]:Firm file=t1 upgrade read end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_part_format][748]:UPG PART FORMAT SET:iVersionFlg=0x10000,iUpgSuccCnt=0x0,iUpgFailCnt=0x1
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=_cfgUpgSecPls upgrade write beg.
[UPG][KEY_WARN][src/sys_firm_upgrade.c][firm_file_write][713]:firm pFileDsc= write skip.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=_cfgUpgSecPls upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=_cfgUpgClass upgrade write beg.
[UPG][KEY_WARN][src/sys_firm_upgrade.c][firm_file_write][713]:firm pFileDsc= write skip.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=_cfgUpgClass upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=hImage upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=hImage upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=hroot.img upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=hroot.img upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=initrun.sh upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=initrun.sh upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=GBK upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=GBK upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=ASC16.bin upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=ASC16.bin upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=IEfile.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=IEfile.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=WebComponents.exe upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=WebComponents.exe upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=execSystemCmd upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=execSystemCmd upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=da_info upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=da_info upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=pppoed upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=pppoed upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=pppd upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=pppd upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=check_config upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=check_config upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=alsa-lib.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=alsa-lib.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=idsp.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=idsp.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=driver.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=driver.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=cmemk.ko upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=cmemk.ko upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=gdmak.ko upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=gdmak.ko upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=recover_mtd upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=recover_mtd upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=ptzCfg.bin upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=ptzCfg.bin upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=davinci upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=davinci upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=davinci.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=davinci.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=ambarella_eth_debug.ko upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=ambarella_eth_debug.ko upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=sound.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=sound.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=lib_so.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=lib_so.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=help.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=help.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=ss upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=ss upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=t1 upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=t1 upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_part_finish][780]:UPG PART FINISH SET:iVersionFlg=0x10000,iUpgSuccCnt=0x2,iUpgFailCnt=0x0
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_part_format][748]:UPG PART FORMAT SET:iVersionFlg=0x10000,iUpgSuccCnt=0x0,iUpgFailCnt=0x1
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=_cfgUpgSecPls upgrade write beg.
[UPG][KEY_WARN][src/sys_firm_upgrade.c][firm_file_write][713]:firm pFileDsc= write skip.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=_cfgUpgSecPls upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=_cfgUpgClass upgrade write beg.
[UPG][KEY_WARN][src/sys_firm_upgrade.c][firm_file_write][713]:firm pFileDsc= write skip.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=_cfgUpgClass upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=hImage upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=hImage upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=hroot.img upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=hroot.img upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=initrun.sh upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=initrun.sh upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=GBK upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=GBK upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=ASC16.bin upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=ASC16.bin upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=IEfile.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=IEfile.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=WebComponents.exe upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=WebComponents.exe upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=execSystemCmd upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=execSystemCmd upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=da_info upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=da_info upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=pppoed upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=pppoed upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=pppd upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=pppd upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=check_config upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=check_config upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=alsa-lib.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=alsa-lib.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=idsp.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=idsp.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=driver.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=driver.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=cmemk.ko upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=cmemk.ko upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=gdmak.ko upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=gdmak.ko upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=recover_mtd upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=recover_mtd upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=ptzCfg.bin upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=ptzCfg.bin upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=davinci upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=davinci upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=davinci.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=davinci.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=ambarella_eth_debug.ko upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=ambarella_eth_debug.ko upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=sound.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=sound.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=lib_so.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=lib_so.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=help.tar.gz upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=help.tar.gz upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=ss upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=ss upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=t1 upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=t1 upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_part_finish][780]:UPG PART FINISH SET:iVersionFlg=0x10000,iUpgSuccCnt=0x3,iUpgFailCnt=0x0
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_upglib_proc][2151]:Firm iPackIdx=0 upgrade end.
[05-27 09:16:25][pid:841][PSIA][ERROR]************* PSIA Upgrading END **************,iRet=0
[05-27 09:16:26][pid:841][OTHER][ERROR] checkUserIdValid is ERROR
[05-27 09:16:26][pid:841][SYSLOG][ERROR]Invalid userID 0
[4l 
 
U-Boot 1.3.4-100728 (Nov 11 2014 - 13:58:34) 
 
ARM Clock: 480MHz 
DDR Clock: 336MHz 
Hit Ctrl+u to stop autoboot: 2 Hit Ctrl+u to stop autoboot: 1 Hit Ctrl+u to stop autoboot: 0 
|BIND err| 
Unknown command:null  
nand booting ... 
load kernel... 
load ramdisk... 
 init started: BusyBox v1.19.3 (2015-03-20 17:37:48 CST)
 starting pid 375, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
UBI device number 1, total 191 LEBs (24643584 bytes, 23.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
cat: read error: Invalid argument
 The system is going down NOW!
 Sent SIGTERM to all processes
 Sent SIGKILL to all processes
 Requesting system reboot
[4l 
 
U-Boot 1.3.4-100728 (Nov 11 2014 - 13:58:34) 
 
ARM Clock: 480MHz 
DDR Clock: 336MHz 
Hit Ctrl+u to stop autoboot: 2 Hit Ctrl+u to stop autoboot: 1 Hit Ctrl+u to stop autoboot: 0 
begin to enter mini system 
 
#

alastairstevenson · May 27, 2015

Interestingly detailed upgrade progress log. 2 sets of writes, presumably to the primary and the secondary mtdblock partitions. And no obvious errors.
It's almost like the upgrade process is not correctly recording the completion status between the pri and sec areas, I'd have expected symmetry in the values shown.

Perhaps something that's not logging does not derive and update the final success count, for reasons that are hidden:

waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:0x0, sec_iUpgSuccCnt:0x0
pri_part and sec_part data error.
cat: read error: Invalid argument
The system is going down NOW!

dknabe · May 27, 2015

Not sure what is going on. Obviously the error for the pri and sec_part was created before the reboot. Then at reboot, the kernel can't read /dev/ubi1_0. Did they switch to a secure file system?

dknabe · May 27, 2015

Ok, I have the camera recovered back to v5.2.5 with all menus in English. I'm planning to disconnect the rs232 from the camera and put it all back together. My objectives in recovering the camera have been met. Hopefully I've produced some info that will be of use to others to regain control of camera hardware that we own. One more observation: The contents of mtd0,1,2,3,4,7 and 17 do not change between v5.0 and 5.3 upgrades. MD5SUMS are all the same across multiple tftp and web firmware upgrades. Cheers, Doug

alastairstevenson · May 27, 2015

Many thanks for sharing, it's been appreciated.
Plenty of food for thought there.

whoslooking · May 28, 2015

I think it maybe time to review the no longer supported region changer program, to see the before and after files and what changes were made to the files as this changed something else, as mtd5 was never touched and a hell of a lot was changed in mtd6 including the CH.

alastairstevenson · May 28, 2015

Sorry, but I don't know what you are referring to with "the no longer supported region changer program"

dknabe · May 28, 2015

For the record, I used hiktools.exe to change the Chinese v5.25 digicap.exe file into English version after updating my mtd5 and 6 to region 1 along with offsetting date string changes. This was done via this command: $ hiktools lang digicap.dav 1. The only changes made to the .dav file were location 0x04 changed from 0xC9 (CH version) to 0xC8 (EN version) and location 0x10 changed from 0xCF (CH version) to 0xCC (EN version). When I did all that, the v5.2.5 camera still reports a CCCH in the serial number.

whoslooking · May 28, 2015

I had CBX change a camera for me about 9 months ago, my first chinese 1, just to see, his program worked well on the camera, but changes a lot more than just the region flag on the mtd6 file, due to the terms agreed with him I won't openly post the files, but I will troll thro to see what else we can learn from, it 's a shame he never gave it away when he quit the seen.

alastairstevenson · May 28, 2015

Oh, OK, now I understand. Thanks.

whoslooking · May 29, 2015

Ok, I have checked the changes made by CBX region changer, on 2 different models, It was as i thought there were no changes made to mtd5, and the mtd6 had a lot,
On the 2cd3410, I have found the region flag thats was in mtd2, so that was a good find, the fact the mtd6 was so different, means this method of region changer would also not work on 5.3.0 without updating, but without telnet to get in a modded firmware would also be need.

dknabe · May 29, 2015

RS232 access to the DS-2CD2032-I is easy to obtain. See earlier posting in this thread. That gives you console access to the bootloader (Das U-Boot) as well as the root console once Linux boots. From U-Boot, (interrupted by Ctrl+U) one has complete control of the machine. You can tftp load anything to memory, write it to a chosen flash location, and boot from it if you wish. If you simply wait for Linux to boot and do a Ctrl+C before initrun.sh starts, you have root access to Linux. From there you can do anything as well.

alastairstevenson · May 30, 2015

Yes, indeed - in contrast to the NVR where the only option is to activate a TFTP upgrade by specifying IP addresses. Frustrating.

With seeing the various problems people were having with recent manufacture cameras I bought a 2CD3332-I to play with. With a 5.2.8 label, it had a hacked 5.2.5 installed giving a prtHardInfo reported language=1, but 2 in the mtdblocks5 & 6..
I changed the language on mtdblock5 & 6 and started to explore the hardware descriptor block checksum scope by changing bytes to see what happened. All recoverable with an official 5.2.5 firmware.
Then I thought I'd move on and created a customised 5.3.0 firmware, modified to inhibit the 'psh' protected shell, permanently enable SSH by flushing iptables rules (I still don't know if there is an SSH enable in the web GUI), and installing the full version of busybox-armv6l. And attaching the serial console, taking some baseline logs before changing anything.
Annoyingly, I've discovered that the camera has a hardware fault that the built-in redundancy is quietly dealing with - mtdblock9 where krn_pri is located is giving random read errors.
With the 5.2.5 firmware, the running environment just quietly uses the krn_sec in mtdblock10 and the camera has no obvious problems, it runs reliably.
However - it looks like the 5.3.0 firmware updater is more strict and whilst writing the kernel to mtdblock9 flags up a write error and drops the camera into the Min-system mode, it doesn't just ignore this and use the krn_sec instead.
Recovery back to 5.2.5 works just fine.
So I don't have a recent-manufacture hardware base on which to experiment with 5.3.0 modifications. All my other cameras are 2014 manufacturer.

dknabe · May 30, 2015

Great work and good information! Unfortunate hardware problem. Maybe HIKVision grades cameras on the factory floor and sends non-fatally defective ones to a secondary market at lower cost rather than rework them.

It may also be possible that there was a hardware change to improve security.

Based on the release notes for 5.3.0, it appears HIKVision is actively locking down their hardware so that no mods are possible. Release note goodies:
1. V5.3.0 products cannot be downgraded to lower version models;
2. Telnet access is forbidden;
3. Lock the remote IP address for 30 minutes once login camera several times with wrong username or password;
4. Delete “help” document in web browser;
5. The Hikvision firmware may contain defects or errors known as errata which may cause the product to deviate from published specifications.
6. This update refers to function/compatibility improvement and will take effect automatically after the Date of Change. We are very sorry for any inconvenience of use-habit changes caused by this action.

alastairstevenson · May 30, 2015

It may also be possible that there was a hardware change to improve security.

Or perhaps features or performance. I didn't mention this, but trying a downgrade to 5.2.3 gets the 'DSP failed to init' error that others have reported. I'd speculate that the DSP has been updated in a way the older firmware can't handle.

sends non-fatally defective ones to a secondary market at lower cost

To be honest, I doubt that. I've seen no flaws on my 6 other Hikvision cameras, and the pricing on Aliexperess is amazingly uniform.

I'm still keen to have a play with the 5.3.0 and up firmware, so I think I may swap this camera for one of my 'in-use' ones, as it does work just fine on the 5.2.5 firmware, and hope that the older camera can take the 5.3.0 firmware.

2. Telnet access is forbidden;

What I haven't seen confirmed is if SSH is still available (even with the psh protected shell). Hikvision got some serious security criticism a little while back, hence the new password change and complexity and lockout rules. Maybe the non-existent security of telnet was part of that response too.

This is my potential hardware error:

[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_part_format][748]:UPG PART FORMAT SET:iVersionFlg=0x10000,iUpgSuccCnt=0x0,iUpgFailCnt=0x1
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=_cfgUpgSecPls upgrade write beg.
[UPG][KEY_WARN][src/sys_firm_upgrade.c][firm_file_write][713]:firm pFileDsc= write skip.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=_cfgUpgSecPls upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=_cfgUpgClass upgrade write beg.
[UPG][KEY_WARN][src/sys_firm_upgrade.c][firm_file_write][713]:firm pFileDsc= write skip.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=_cfgUpgClass upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=hImage upgrade write beg.
[UPG][RT_ERROR][src/sys_firm_flash.c][flash_block_write][371]:iFd=61,iOffSet=0x300000,errno=2(No such file or directory),block error!
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=hImage upgrade write end.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2080]:Firm file=hroot.img upgrade write beg.
[UPG][DEBUG_NOTICE][src/sys_firm_upgrade.c][firm_srcs_write][2102]:Firm file=hroot.img upgrade write end.

It's repeatable. If I pull a copy of mtdblock9 I get an I/O error. If I use mtd9ro it apparently reads OK, but all after 0x300000 is zeroed.
I might see if u-boot has any flash testing capabilities.

slamb · Jan 19, 2016

alastairstevenson said:
You do need to use the Hikvision-specific TFTP server to be able to use the TFTP recovery method. There are links to the download in multiple posts, should still be possible to Google for it. I don't have a link to hand.
The access to port 9978 that you saw is the camera emitting a UDP packet with the Hikvision 'Magic number' SWKH to look for a Hikvision-specific response from the TFTP server. If the TFPT server provides the response (a UDP packet on 9979 with the Magic number in the payload), the camera will connect to it and attempt a download and install of digicap.dav for the firmware update.

I found using the Hikvision TFTP server to be a pain, as I had to go out of my way to install a Windows VM for it. But this handshake really is very simple. I wrote a Python script for it. With this, you can use any TFTP server on any platform.

alastairstevenson · Jan 19, 2016

Excellent! And well done for sharing the code, I'll try this on my Linux box.

dknabe · Jan 19, 2016

Thanks!! Now if we can just figure out how to move v5.3.0 CH cameras to US region so that we can get security and capability updates.

Search

Search

Hikvision DS-2032-I Console Recovery

alastairstevenson

dknabe

Young grasshopper

dknabe

Young grasshopper

alastairstevenson

dknabe

Young grasshopper

dknabe

Young grasshopper

alastairstevenson

whoslooking

alastairstevenson

dknabe

Young grasshopper

whoslooking

alastairstevenson

whoslooking

dknabe

Young grasshopper

alastairstevenson

dknabe

Young grasshopper

alastairstevenson

slamb

n3wb

alastairstevenson

dknabe

Young grasshopper